Zimbra Collaboration Suite Unauthenticated RCE (CVE-2022-27925)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•28

Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection in Zimbra Collaboration Suite Email Server, specifically targeting CVE-2022-27925. The rule looks for POST requests to the '/service/extension/backup/mboximport' endpoint with specific query parameters ('account-name', 'ow', 'no-switch', 'append') and then checks for subsequent requests to '/zimbraAdmin/*.jsp' with a 200 status code, indicating potential successful exploitation and web shell access.